I have setup a transform to ideally set the hostname and sourcetype for syslog traffic, however I'm encountering problems.
I have the following in the transforms.conf:
[firepass_sourcetyper] REGEX =
(?:192.168.249.106) DEST_KEY =
MetaData:sourcetype FORMAT =
sourcetype::firepass_log[firepass_hostnamer] REGEX =
(?:192.168.249.106) DEST_KEY =
MetaData:host FORMAT =
host::rm.markerstudy.com
And I have the following in my props.conf file:
[source::udp:514]
TRANSFORMS-firepasssoucetype = firepass_sourcetyper
TRANSFORMS-firepasshostname = firepass_hostnamer
I'm not sure if it's possible to do multiple transforms for a single source as I am trying, however for the purpose of testing this I have commented out the second transforms statement.
Can anybody help as to why this isn't working?
Thanks,
Neil
I have a similar problem. I am trying get the three IP addresses to use a new sourcetye when they send in data.
Props.conf reads :
[source::udp:514]
TRANSFORMS-riverbed_src = riverbed_steelhead
TRANSFORMS-changesourcetype = sourcetype_cisco_asa
transforms.conf reads :
[riverbed_steelhead]
REGEX = (10.12.0.20:10.0.0.33:10.10.20.185)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::riverbed_steelhead
[sourcetype_cisco_asa]
REGEX = (10.12.254.1:10.10.20.254:10.1.250.254)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::cisco_asa
I get the Error :
Possible typo in stanza [riverbed_steelhead] in transforms.conf. Line 4
Possible typo in stanza [sourcetype_cisco_asa] in transforms.conf. Line 10
Can someone help me find my problem please.
FYI : I also tried the format :
REGEX = (10.\12.0.20|10.0.0.33|10.10.20.185)
Both answers were spot on.
Thanks,
Neil,
You should be able to put all of your transforms on one line...ie.
[source::udp::514]
TRANSFORMS-firepass_stuff = firepass_sourcetyper,firepass_hostnamer
Also keep in mind that the DEST_KEY(s) are case sensitive, so you would need:
[firepass_sourcetyper]
REGEX = (?:192.168.249.106)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::firepass_log
[firepass_hostnamer]
REGEX = (?:192.168.249.106)
DEST_KEY = MetaData:Host
FORMAT = host::rm.markerstudy.com
Hope that helps.
Hi, I think you problem is that the MetaData variables are case sensative.
Try:
In props.conf
[source::udp:514]
TRANSFORMS-firepasssoucetype = firepass_sourcetyper
TRANSFORMS-firepasshostname = firepass_hostnamer
In transforms.conf
[firepass_sourcetyper]
REGEX = (?:192.168.249.106)
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::firepass_log
[firepass_hostnamer]
REGEX = (?:192.168.249.106)
DEST_KEY = MetaData:Host
FORMAT = host::rm.markerstudy.com